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Abstract 



We present a novel self-stabilizing algorithm for minimum spanning tree (MST) con- 
struction. The space complexity of our solution is 0(log^ n) bits and it converges in O(n^) 
rounds. Thus, this algorithm improves the convergence time of all previously known self- 
stabilizing asynchronous MST algorithms by a multiplicative factor &{n), to the price of 
increasing the best known space complexity by a factor O(logn). The main ingredient used 
in our algorithm is the design, for the first time in self-stabilizing settings, of a labeling 
, scheme for computing the nearest common ancestor with only 0(log^ n) bits. 



1 Introduction 



^ ■ Since its introduction in a centralized context [15, 14], the minimum spanning tree (or MST) 

problem gained a benchmark status in distributed computing thanks to the seminal work of 
Gallager, Humblet and Spira [9]. 
ff^ ' The emergence of large scale and dynamic systems, often subject to transient faults, revives 

. the study of scalable and self-stabilizing algorithms. A scalable algorithm does not rely on any 

I global parameter of the system {e.g. upper bound on the number of nodes or the diameter). 

Self- stabilization introduced first by Dijkstra in [6] and later publicized by several books [7, 8] 
deals with the ability of a system to recover from catastrophic situation (i.e., the global state 
may be arbitrarily far from a legal state) without external {e.g. human) intervention in finite 
^ I time. 

■ Although there already exists self-stabilizing solutions for the MST construction, none of 

them considered the extension of the Gallager, Humblet and Spira algorithm (GHS) to self- 
stabilizing settings. Interestingly, this algorithm unifies the best properties for designing large 
scale MSTs: it is fast and totally decentralized and it does not rely on any global parameter 
of the system. Our work proposes an extension of this algorithm to self-stabilizing settings. 
Our extension uses only logarithmic memory and preserves all the good characteristics of the 
original solution in terms of convergence time and scalability. 

Gupta and Srimani presented in [13] the first self-stabilizing algorithm for the MST problem. 
The MST construction is based on the computation of all shortest paths (for a certain cost 
function) between all pairs of nodes. While executing the algorithm, every node stores the cost 
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of all paths from it to all the other nodes. To implement this algorithm, the authors assume 
that every node knows the number n of nodes in the network, and that the identifiers of the 
nodes are in {1, . . . ,n}. Every node u stores the weight of the edge Cu^v placed in the MST 
for each node v ^ u. Therefore the algorithm requires log ■w(e„^^)) bits of memory at 

node u. Since all the weights are distinct integers, the memory requirement at each node is 
r2(n log n) bits. The main drawback of this solution is its lack of scalability since each node 
has to know and maintain information for all the nodes in the system. Note also that the 
time complexity announced by the authors, 0(n) stays only in the particular synchronous 
settings considered by the authors. In asynchronous setting the complexity is r2(n^) rounds. 
A different approach for the message-passing model, was proposed by Higham and Liang [11]. 
The algorithm performs roughly as follows: every edge checks whether it eventually belongs to 
the MST or not. To this end, every non tree-edge e floods the network to find a potential cycle, 
and when e receives its own message back along a cycle, it uses the information collected by 
this message (i.e., the maximum edge weight of the traversed cycle) to decide whether e could 
potentially be in the MST or not. If the edge e has not received its message back after the 
time-out interval, it decides to become tree edge. The memory used by each node is O(logn) 
bits, but the information exchanged between neighboring nodes is of size 0(n log n) bits, thus 
only slightly improving that of [13]. This solution also assume that each node has access to 
a global parameter of the system: the diameter. Its computation is expensive in large scale 
systems and becomes even harder in dynamic settings. The time complexity of this approach 
is 0{mD) rounds where m and D are the number of edges and the diameter of the network 
respectively, i.e., O(n^) rounds in the worst case. 

In [2] we proposed a self-stabilizing loop-free algorithm for the MST problem. Contrary 
to previous self-stabilizing MST protocols, this algorithm does not make any assumption on 
the network size (including upper bounds) or the unicity of the edge weights. The proposed 
solution improves on the memory space usage since each participant needs only O(logn) bits 
while preserving the same time complexity as the algorithm in [11]. 

Clearly, in the self-stabilizing implementation of the MST algorithms there is a trade-off be- 
tween the memory complexity and their time complexity (see Table 1, where a boldface denotes 
the most useful (or efficient) feature for a particular criterium). The challenge we address in this 
paper is to design fast and scalable self-stabilizing MST with little memory. Our approach brings 
together two worlds: the time efficient MST constructions and the memory compact informative 
labeling schemes. Therefore, we extend the CHS algorithm to self-stabilizing settings and keep 
compact its memory space by using a self-stabilizing extension of the nearest common ancestor 
labeling scheme of [1]. Note that labeling schemes have already been used in order to infer a 
broad set of information such as vertex adjacency, distance, tree ancestry or tree routing [5], 
however none of these schemes have been studied in self-stabilizing settings (except the last one) . 

Our contribution is therefore twofold. We propose for the first time in self-stabilizing settings 
a 0{log^n) bits scheme for computing the nearest common ancestor. Furthermore, based on 
this scheme, we describe a new self-stabilizing algorithm for the MST problem. Our algorithm 
does not make any assumption on the network size (including upper bounds) or the existence 
of an a priori known root. Moreover, our solution is the best space/time compromise over the 
existing self-stabilizing MST solutions. The convergence time is 0{n?) asynchronous rounds and 
the memory space per node is O(log^n) bits. Interestingly, our work is the first to prove the 
effectiveness of an informative labeling scheme in self-stabilizing settings and therefore opens a 
wide research path in this direction. 



2 





a priori knowledge 


space complexity 


convergence time 


[13] 


network size and 
the nodes in the network 


0(n log n) 




[11] 


upper bound on diameter 


O(logn) 
+messages of size O(nlogn) 




[2] 


none 


O(logn) 




This paper 


none 


0(log^ n) 


O(n^) 



Table 1: Distributed Self-Stabilizing algorithms for the MST problem 



2 Model and notations 

We consider an undirected weighted connected network G = {V, E, w) where V is the set of 
nodes, E is the set of edges and w : E ^ M+ is a positive cost function. Nodes represent 
processors and edges represent bidirectional communication links. Additionally, we consider 
that G = {V, E, w) is a network in which the weight of the communication links may change 
value. 

The processors asynchronously execute their programs consisting of a set of variables and a 
finite set of rules. The variables are part of the shared register which is used to communicate 
with the neighbors. A processor can read and write its own registers and can read the shared 
registers of its neighbors. Each processor executes a program consisting of a sequence of guarded 
rules. Each rule contains a guard (Boolean expression over the variables of a node and its 
neighborhood) and an action (update of the node variables only). Any rule whose guard is true 
is said to be enabled. A node with one or more enabled rules is said to be privileged and may 
make a move executing the action corresponding to the chosen enabled rule. 

A local state of a node is the value of the local variables of the node and the state of its 
program counter. A configuration of the system G = {V, E) is the cross product of the local 
states of all nodes in the system. The transition from a configuration to the next one is produced 
by the execution of an action at a node. A computation of the system is defined as a weakly 
fair, maximal sequence of configurations, e = (cq, ci, . . . Cj, . . .), where each configuration Cj+i 
follows from q by the execution of a single action of at least one node. During an execution 
step, one or more processors execute an action and a processor may take at most one action. 
Weak fairness of the sequence means that if any action in G is continuously enabled along the 
sequence, it is eventually chosen for execution. Maximality means that the sequence is either 
infinite, or it is finite and no action of G is enabled in the final global state. 

In the sequel we consider the system can start in any configuration. That is, the local state 
of a node can be corrupted. Note that we don't make any assumption on the bound of corrupted 
nodes. In the worst case all the nodes in the system may start in a corrupted configuration. In 
order to tackle these faults we use self-stabilization techniques. 

Definition 1 (self-stabilization) Let he a non-empty legitimacy predicate^ of an algo- 
rithm A with respect to a specification predicate Spec such that every configuration satisfying 
£_4 satisfies Spec. Algorithm A is self-stabilizing with respect to Spec iff the following two 
conditions hold: 

(!) Every computation of A starting from a configuration satisfying Lji^ preserves Lj\^ ( closurej. 
( a) Every computation of A starting from an arbitrary configuration contains a configuration 
that satisfies Ljs, convergence j. 

^ A legitimacy predicate is defined over the configurations of a system and is an indicator of its correct behavior. 
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3 Overview of our solution 



We propose to extend the Gallager, Humblet and Spira (GHS) algorithm, [9], to self-stabihzing 
settings via a compact informative labeling scheme. Thus, the resulting solution presents several 
advantages appealing for large scale systems: it is compact since it uses only logarithmic memory 
in the size of the network, it scales well since it does not rely on any global parameter of 
the system, it is fast — its time complexity is the better known in self-stabilizing settings. 
Additionally, it self-recovers from any transient fault. 

The central notion in the GHS approach is the notion of fragment. A fragment is a partial 
spanning tree of the graph, i.e., a fragment is a tree which spans a subset of nodes. Note that 
a fragment can be limited to a single node. An outgoing edge of a fragment F is an edge with 
a unique endpoint in F. The minimum-weight outgoing edge of a fragment F is denoted in the 
following as ME^. In the GHS construction, initially each node is a fragment. For each fragment 
F, the GHS algorithm in [9] identifies the WEp and merges the two fragments endpoints of 
KEp. Note that, with this scheme, more than two fragments may be merged concurrently. The 
merging process is recursively repeated until a single fragment remains. The result is a MST. 
The above approach is often called "blue rule" for MST construction. 

This approach is particularly appealing when transient faults yield to a forest of fragments 
(which are sub-trees of a MST). The direct application of the blue rule allows the system to 
reconstruct a MST and to recover from faults which have divided the existing MST. However, 
when more severe faults hit the system the process variables may be corrupted leading to a 
configuration of the network where the set of fragments are not sub-trees of some MST. That 
is, it may be a spanning tree but not of minimum weight, or it can contain cycles. In this case, 
the application of the blue rule only is not sufficient to reconstruct a MST. To overcome this 
difficulty, we combine the blue rule with another method, referred in the literature as the "red 
rule". The red rule removes the heaviest edge from every cycle. The resulting configuration 
contains a MST. We use the red rule as follows: given a spanning tree T of G, every edge e 
of G that is not in T is added to T, thus creating a (unique) cycle in T U {e}. This cycle is 
called a fundamental cycle, denoted by Cg. If e is not the edge of maximum weight in Cg, then, 
according to the red rule, there exists an edge / 7^ e in Cg with w(/) > w{e). The edge of 
maximum weight can be removed since it is not part of any MST. 

Our MST construction combines both the blue and red rules. The blue rule application 
needs that each node identifies its own fragment. The red rule requires that nodes identify 
the fundamental cycle corresponding to every adjacent non-tree-edge. In both cases, we use a 
self-stabilizing labeling scheme, called NCA-L, which provides at each node a distinct informative 
label such that the nearest common ancestor of two nodes can be identified based only on the 
labels of these nodes (see Section 3.1). Thus, the advantage of this labeling is twofold. First 
the labeling helps nodes to identify their fragments. Second, given any non-tree edge e = {u, v), 
the path in the tree going from u to the nearest common ancestor of u and v, then from there 
to V, and finally back to u by traversing e, constitute the fundamental cycle Cg. 

To summarize, our algorithm will use the blue rule to construct a spanning tree, and the 
red rule to recover from invalid configurations. In both cases, it uses our algorithm NCA-L to 
identify both fragments and fundamental cycles. Note that, in [3, 4] distributed algorithms 
using the blue and red rules to construct a MST in a dynamic network are proposed, however 
these algorithms are not self-stabilizing. 

Variables used by NCA-L and MST modules For any node v € V{G), we denote by N{v) 
the set of all neighbors of v in G. We use the following notations: 

• p^: the parent of v in the current spanning tree, an integer pointer to a neighbor; 
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• i^: the label of v composed of a list of pairs of integers where each pair is an identifier and 
a distance (the size of is bounded by 0(log^ n) bits); 

• size^: a pair of variables, the first one is an integer the number of nodes in the sub-tree 
rooted at v and the second one is the identifier of the child u of v with the maximum 
number of nodes in the sub-tree rooted at u; 

• mwe^: the minimum weighted edge composed by a pair of variables, the first one is an 
integer, the weight of the edge and the second one is the label of a node u stored in 

3.1 Self-stabilizing Nearest Common Ancestor Labeling 

Our labeling scheme, called in the following NCA-L, uses the notions of heavy and light edges 
introduced in [10]. In a tree, a heavy edge is an edge between a node u and one of its children v 
of maximum number of nodes in its sub-tree. The other edges between u and its other children 
are tagged as light edges. We extend this edge designation to the nodes, a node v is called 
heavy node if the edge between v and its parent is a heavy edge, otherwise v is called light node. 
Moreover, the root of a tree is a heavy node. The idea of the scheme is as follows. A tree is 
recursively divided into disjoint paths: the heavy and the light paths which contain only heavy 
and light edges respectively. 



Child = {ue N{v) : = ld„} 

SizeC(f) = Leaf(f) V {sizey = (1 -|- J2ueChi[d{v) s^-^e^, arg maxjsizeu : u € Child(t))})) 

Leaf(i;) = {^u G N{v),p^ = \dy) A size^ = (1,-L) 

Label(f ) = Labelij('y) V Label7Vd(w) 

LahelRiv) = {p^ = (DA£y = (ld„, 0)) 

LahelNd{v) = Py & N{v) A (Heavy(-y) V Light(t;)) 

Heavy(7;) = sizepjl] = ld„ A szze„[0] < sizepJO] A last(^p^)[l] -|- 1 = last(^i,)[l] 
Light(7;) = sizepjl] ^ \di, A sizev[0] < sizep JO]/2 Aiy = £p^.(ld^,0) 



nca{u, v) 



{ Liao, ai) s.t. 4 n 4 = A 4 = t{ao, a^)!^ if (ao = 6o V ^ / 0) 
and 4 = e.{bo, bi).iy Mu < £v 

L{boM) s.t. iuniy = i,eu = t{ao,ai).C if (ao = 6o V £ / 0) 
and 4 = ^-(^0, h)-^v -< L 



otherwise 



Cycle(t;) = ly C ip^ V 4 ^ 

MinEnabled(u) ee Enabled(7;) A (Vn G 7V(t;), Enabled(n) A Id^ < ld„) 



Figure 1: Predicates used by the algorithm NCA-L for the labeling procedure. 

To label the nodes in a tree T, the size of each subtree rooted at each node of T is needed 
to identify heavy edges leading the heaviest subtrees at each level of T. To this end, each 
node V maintains a variable named sizey which is a pair of integers. The first integer is the 
local estimation of the number of nodes in the subtree rooted at v. The second integer is the 
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identifier of a child of v with maximum number of nodes. That is, it indicates the heavy edge. 
The computation of sizcy is processed from the leaves to the root (see Predicate SizeC(f) in 
Figure 1). A leaf has no child, therefore size^ = (1,-L) for a leaf node v (see Predicate Leaf(?;) 
in Figure 1 and Rule R^). 

Based on the heavy and light nodes in a tree T indicated by variable size^ at each node 
V each node of T can compute its label. The label of a node v stored in iy is a list of pair of 
integers. Each pair of the list contains the identifier of a node and a distance to the root of the 
heavy path (i.e., a path including only heavy edges). For the root u of a fragment, the label iy 
is the following pair (ldt,,0), respectively the identifier of v and the distance to itself, i.e., zero 
(see Rule R©). When a node u is tagged by its parent as a heavy node (i.e., sizep^[l] = ld„), 
then the node u takes the label of its parent but it increases by one the distance of the last pair 
of the parent label. Examples of theses cases are given in Figure 2, where integers inside the 
nodes are node identifiers and lists of pairs of values are node labels. When a node u is tagged 
by its parent u as a light node (i.e., sixep^fl] ^ Id^), then the node u becomes the root of a 
heavy path and it takes the label of its parent to which it adds a pair of integers composed of 
its identifier and a zero distance (see Figure 2). 



This labeling scheme is used in second part of this article in MST algorithm to find the 
minimum weighted edges, but it is also used to detect and destroy cycles since the initial con- 
figuration may not be a spanning tree. To this end, we define an order -< on the labels of nodes. 
Let a and b be two nodes and ia and if, be their respective labels such that £a = ^-(oO) Q^i)-^a 
and £b = i-{bo,bi).i'f, with £a h = i- The label of a node a is lower than the label of node 
b, noted ia -< if (1) («0) = ^ and {bo, bi).i'i, ^ 0, or (2) cq < &o or (3) ao = bo and oi < bi. 

A node u can detect the presence of a cycle by only comparing its label with the label of its 
parent. That is, if its label is contained in the label of its parent, or it is inferior to the one of 
its parent then u is part of a cycle (see Predicate Cycle(f ) in Figure 1). In this case, the node 
u becomes the root of its fragment in order to break the cycle (see below Rule R©). 

Algorithm NCA-L is composed of two rules. Rule Rq creates a root or breaks cycles while 
rule Rf produces a proper labeling. Note that the last predicates in rules R© and R^ (the part 
in gray) are used only for insuring the exclusivity of rules execution when the labeling scheme 
works together with the MST scheme. 




Non tree edge: ■ 



Heavy tree edge: 



Ligtit tree edge: 



Figure 2: Labeling scheme 
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A node v with an incoherent parent (which is not one of its neighbors) or present in a cycle 
executes R©. Following the execution of this rule node v becomes a root node, it sets its parent 
to void and its label to (ldt,,0). 

Rule R^ helps a node v to compute the number of nodes in its sub-tree (stored in variable 
) and provides to v a coherent label. 

R©: [ Root creation ] 

If N{v) V (p^ = A 4, ^ (ld^,,0) V (Cycle(?;) A^NeedReorientation(?;)) 
Thenp„:=0; 4 = (ld^,0); 

R^: [ Label correction ] 

If ^Cycle(u) A (^SizeC(i;) V ^Label(?;)) AMinEnabled('t;) A ^TreeMerg(?;) 
Then If Leaf(t;) then sizey = (1,-L) 

Else size^ := (1 + I^MgChildCj;) argmax{si2eu : u G Child(i;)}); 

If sizepjl] = ld„ then 4 := ip^; /ast(4)[l] := last{Q[l\ + 1; 

Else ^p^ .(ld^,0) 

3.2 Self-stabilizing MST 

In this section we describe our self-stabilizing MST algorithm. The algorithm executes two phases: 
the MST correction and the MST fragments merging. Recall that our algorithm uses the blue 
rule to construct a spanning tree and the red rule to recover from invalid configurations. In 
both cases, it uses the nearest-common ancestor labeling scheme to identify fragments and fun- 
damental cycles. We assume in the following that the merging operations have a higher priority 
than the recovering operations. That is, the system recovers from an invalid configuration if 
and only if no merging operation is possible. In the worst case, after a failure hit the system, a 
merging phase will be followed by a recovering phase and finally by a final merging phase. 

3.2.1 The minimum weighted edge and MST correction 

Note that the scope of our labeling scheme is twofold. First, it allows a node to identify the 
neighbors that share the same fragment and consequently to select the outgoing edges of a 
fragment. Second, the labeling scheme may be used to identify cycles and to repair the tree. To 
this end, the algorithm uses the nearest common ancestor predicate nca depicted in Figure 1. For 
two nodes u and v with e = {u, v) a non tree edge (i.e., p^i^ v and p^ 7^ u), if the nearest common 
ancestor does not exist then u and v are in two distinct fragments (i.e., if we have nca{u, v) =0). 
Otherwise u and v are in the same fragment F and the addition of e to -F generates a cycle. 
Let path(x, y) be the set of edges on the unique path between x and y in F, with x,y G F. 
The fundamental cycle Cg is the following: Ce = path(n, nca(n, v)) U pa.th{nca{u,v),v) U e. 
Consider the example depicted on Figure 2(b). The labels of nodes 10 and 6 are respectively 
£10 = (2,3) and £q = (3, 1). In this case nca(10,6) = so the edge (10,6) is an outgoing edge 
because the nodes 10 and 6 are in two distinct fragments and they have no common ancestor. 
If the edge (10,6) is of minimum weight then (10,6) can be used for a merging between the 
fragment rooted in 2 and the fragment rooted in 3. For the case of nodes 10 and 9 the labels 
are iio = (2,3) and ig = (2,1)(9, 0) and nca(10,9) = (2,1). Consequently, 10 and 9 are in the 
same fragment. The fundamental cycle Cg with e = (9, 10) goes through the node with the 
label nca(10, 9), in other word the node 5 in Figure 2(b). 

Predicate MinEdge(u) (see Figure 3) computes both the minimum weight outgoing edge 
used in a merging phase and the internal edges used in a recovering phase. Our algorithm 
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MergeChild(t;) = min{m?/;e„ : u € Child(t;) A mweu[l] = 0} 

MergeAdj {v) = {min{w{u, v) : u ^ N{v) \ Child(i)) \ {p^} A nca{u, u ) = 0}, 0) 

MergeEdge(u) = min{MergeChild(t;), MergeAdj (w)} 

FarLcaChild(f ) = argmin^{m?i'eu[l] : u G Child(i;) A mi(;e„[l] ^ i^} 

RecoverChild(?; ) = mwcu such that FarLcaChild(?;) = u 

FarLca(?;) = arg min^{nca(u, : u € N{v) \ Child(?;) \ {p^} A mwe^ll] ^ 0A 

nca{u,v) >~ mwey[l]Anca{u,v) ^ 0} 



Recover Adj (v) 



RecoverEdge(t;) = 



{w{u,v),nca{u,v)) s.t. FarLca(?;) = u if FarLca(i;) 7^ 

w{u,v),nca{u,v)) otherwise 
s.t. u = arg min^ {nca(n, -y) : 
u G N{v) \ Child{v) \ {p^} A nca{u, v) / 0} 

RecoverChild(i)) if Recover Adj (f) [1] -< RecoverChild(f ) 
Recover Adj {v) otherwise 



MinEdge(?;) = 



MergeEdge(f) if MergeEdge(t;) ^ 
RecoverEdge(u) otherwise 



NeedReorientation('y) = LabelR(z;) V = (_L, 1.) /\pp = Id^,) 
EndReorientation(t;) = ip^ = (0, 0) A (4 = (-L, ±) V ^ / (0, 0)) 
TreeMerg(t>) = NeedReorientation(?;) V EndReorientation(u) 
NewFrag(u) = mwey = mwep^ A mwe^[l] 7^ ld,y A w{v,p^) > mwei,[0] 



Figure 3: Predicates used by the MST for the tree correction or the fusion fragments. 

gives priority to the computation of minimum outgoing edges via Predicate MinEdge(t'). A 
recovering phase is initiated if there exists a unique tree or if a sub-tree of one fragment has no 
outgoing edge. 

The computation of the minimum weight outgoing edge is done in a fragment if and only 
an adjacent fragment Fy is detected by Fu, i.e., if we have Predicate MergeEdge(f ) 7^ 0. In this 
case, using Rule RMm each node collects from the leaves to the root the outgoing edges leading 
to an adjacent fragment Fy. At each level in a fragment, a node selects the outgoing edge of 
minimum weight among the outgoing edges selected by its children and its adjacent outgoing 
edges. Thus, this allows to the root of a fragment to select the minimum outgoing edge e of the 
fragment leading to an adjacent fragment. Then, the edge e can be used to perform a merging 
between two adjacent fragments using an edge belonging to a MST. 

Let us explain Rule R^ which allows to correct a tree (or a fragment). In this case, the 
information about the non-tree edges are sent to the root as follows. Among all its non-tree 
edges, a node u sends the edge e = {u, v) with the nca{u, v) nearest to the root (see Figure 4(a)). 
The information about the edge e is stored in variable mwcu- If the parent x of the node u has 
the same information and the weight of the edge w{u, x) > w{e) then the edge (u, v) is removed 
from the tree (see Figure 4(a-b) for the nodes 6 and 10). We use the red rule in an intensive 
way, because we remove all the edges with a weight upper than 'w{e) in fundamental cycle of e. 
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This interpretation of the red rule ahows to insure that after a recovering phase the remaining 
edges belong to a MST. 




Figure 4: Minimum weighted edge computation and Tree correction. The bubble at each node 
V corresponds to the weight and the label of the common ancestor of the edge stored on variable 
mwey. 



KMin- [ Minimum computation ] 

If -iCycle(u) ALabel(u) A [{mwev 7^ MinEdge(u) AMergeEdge(u) / 0) V {mwep = mwev A 

MergeEdge(u) = 0)] 

Then mwey := MinEdge('y); 

: [ MST Correction ] 

If -■Cycle(u) A Label(u) A NewFrag(u) 
Then py := 0; 4 := (ld^,0); 

To summarize, in this section we explained how to compute the outgoing-edges and the 
fundamental cycles (Rule RMm)? and how to recover from a false tree (Rule R^). The next 
section addresses the fragments merging operation (Rules R><] and Rq)- 

3.2.2 Fragments merging 

In this phase two rules are executed: R>< and Rq- Note that Rule Rjv/m (described in the 
previous section) computes from the leaves to the root the minimum outgoing edge e = (u, v) 
of the fragment F^, with u € Fy^. The information about e are stored in the variable mwe, i.e., 
the weight of the edge and a common ancestor equal to 00 to indicate that these information 
concern an outgoing edge. When a root r of F^ has stabilized its variable mwer, it starts a 
merging phase (Rule Rx). To this end, the nodes in the path between r and u are reoriented 
from r to v. During this reorientation the labels are locked. That is, each node x on the path 
between r and u (including r and excluding v) changes its label to: iy := (_L, _L). When a node 
u becomes the root of the fragment F^ it can merge with the fragment Fy. After the addition 
of the outgoing edge e, the labeling process is re-started (see Rule Rq)- The merging phase is 
repeated until a single fragment is obtained. 

R^<]: [ Merging ] 

If NeedReorientation(t)) A mwey = MergeEdge(v) 
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Then 

If {3u € N{v)\Child{v)\{pJ,w{u,v) = MergeEdge(7;) A ld„ > ld„) 
Then 

p„ := min{ldu : u G N{v)\Child{v)\{Pi,} A w{u,v) = MergeEdge(v)}; 
iv := (0,0); 

If {3u G N{v)\Childiv)\{p^}, w{u, v) = MergeEdge(7;) A ld„ < ld„ A = \div) 
Then 4 := (0,0); 

Else Py := min{ldu : u € Child{v) A mwey = MergeEdge(i;)}; 
4 := (^,^); 

Rq: [ End Merging ] 

If -iNeedReorieiitation(t;) A EndReorientation(?;) 
Then 4 := (0,0); 

4 Correctness proof 

Lemma 1 Let C a configuration where the set of variables Pi,,v G V, form at least one cycle in 
the network. In a finite time, Algorithm NCA-L removes all the cycles from the network. 

Proof. If a node v has a parent which is not in its neighborhood or if v has no parent then 
the parent and the label variable of v is modified to and (ld„,0) respectively with Rule R0. 

A node v identifies a cycle with Predicate Cycle(?;) which uses v's label and the label of 
its parent. In a legitimate configuration, v's label is smaller than the label of its parent and 
is constructed using the label of its parent, i.e., the label of the parent of v is included to w's 
label. Thus, if the label of v is included or is smaller than the label of its parent then a cycle is 
detected and Predicate Cycle(f ) is true. In this case, v reinitiates its parent and label variable 
using Rule Rq. 

In order to detect a cycle the label computation process must cross a part or all the nodes 
of the cycle. However, since we consider a distributed scheduler then all the nodes in a cycle 
can be activated and we can have a rotation of the labels of the nodes in the cycle. This may 
lead to a new configuration in which the labels cannot be used to detect a cycle, because the 
label of one node is not used to compute some other labels and to detect a cycle. To break this 
symmetry, we use the node identifiers with Predicate MinEnabled(z;). This predicate allows to 
activate the node v iS v has no neighbor u such that u is activated and li's identifier is lower 
than V. Therefore, there is at least a node x in the cycle which is not activated and when the 
label of X is used by some other nodes to compute their labels then Predicate Cycle(x) is true 
and X breaks the cycle using Rule Kq. □ 

According to Lemma 1, if the system starts from a configuration which contains at least one 
cycle then all the cycles are removed from the network in a finite time. Therefore, in the 
following we consider only configurations containing no cycle. 

Definition 2 (Legitimate state of NCA-L) Let C a configuration with no cycle in the net- 
work, i.e., which contains a forest of trees T = {Vr Q V,Et Q E). The configuration C is 
legitimate for Algorithm NCA-L iff each node v (zVp satisfies one of the following conditions: 

1. the label of v is equal to ip .(ld„, 0), if the edge between v and v 's parent in T is a light 
edge or v is the root of the tree; 

2. the label i„ of v is equal to ip and last{£i,)[l] = last{iparent)m + 1, if the edge between v 
and V 's parent in T is a heavy edge. 
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Lemma 2 (Convergence for NCA-L) Starting from an illegitimate configuration for Algo- 
rithm NCA-L, eventually Algorithm NCA-L reaches in a finite time a legitimate configuration. 

Proof. To compute correct node labels, heavy and light edges in each tree T = {Vt,Et) of 
the forest in the network must be identified. To this end, each node v G Vr maintains in the 
variable size^ two information: the size of its subtree in T and the identifier of the child with 
the subtree of maximum number of nodes. Based on the first information given by its children 
u € Vt stored in variable sizcu, each node v compute the size of its subtree in T and informs 
its child u if the edge (n, v) £ Et is a light or heavy edge. The edge {u, v) S Et is a heavy 
edge if the second information stored in size^ is equal to Id^ the identifier of a light edge 
otherwise. Therefore, each node v (zVr can detect if its label is correct according to its parent 
label. Note that Predicate MinEnabled(?;) is used at node v £ V to help to break cycle if we 
are in the case of a configuration described in proof of Lemma 1. Moreover, since we use the 
labeling scheme with minimum spanning tree computation rules Predicate TreeMerg(?;) is used 
to forbid the label correction when it has been modified by Rule ,R[>< and Rq- 

The computation of the information stored in the variable size^ at each node u € Vr is done 
via bottom- up fashion in the tree T. According to Predicate SizeC(?;), if the variable sizcy is not 
equal to (1, ±) at a leaf node t; in T then Predicate SizeC{v) = false and v can execute Rule R^ 
to correct its variable size^. Otherwise according to Predicate SizeC(f), for any internal node 
V (zVt the first information of size^ must be equal to one plus the sum of the size of the children 
subtrees and the second one to the identifier of its child with the maximum subtree size. Thus, 
if variable size^ is not correct (i.e.. Predicate SizeC(u) = false) then v can execute Rule R^ to 
correct its variable size^. Using the same argument, one can show by induction that for any 
internal node v G Vp we have sizCy = (1 + X^„gChild(D) sizCu, a,rgmax{sizeu : u G Child(f)}). 

The computation of the node labels in a tree T is done via top-down fashion starting 
from the root of T. For convenience, a path is called heavy (resp. light) if it contains only 
heavy (resp. light) edges. Moreover, a node is called heavy (resp. light) if the edge between 
its parent and itself is a heavy (resp. light) edge, v is informed by its parent with sizep 
if is a heavy (i.e., sizep^[l] = Id^,) or light (i.e., si2e|j^[l] \dy) node. The root node v 
of T is also the root of a heavy path and its label must be equal to (ld„,0). According to 
Predicate Label(u) and Labelij(u), v can execute Rule R^ to correct its label. Otherwise, we 
have two cases: heavy or light nodes. When the root have a correct label then all its children 
can compute their correct label. If a heavy (resp. light) node has a label different from ip 
and last{£y)[l] = last{£parent)m + 1 (resp. £p^.(ld„,0)) then we have Predicate Heavy{v) = 
false (resp. Light('u) = false), LabelArrf(f) = false and Label(?;) = false. Therefore, v can 
execute Rule R^ to correct its label 1^ accordingly with its parent. Using the same argument, 
one can show by induction that for any internal node f € we have Ip and last{ly)[l\ = 
last{iparent)m + 1 (resp. .(Id^,, 0)) for heavy (resp. light) nodes. □ 

Lemma 3 (Closure for NCA-L) The set of legitimate configurations for NCA-L is closed. 

Proof. According to Algorithm NCA-L, the labeling procedure is done using only Rule R^. In 
any legitimate configuration for Algorithm NCA-L, for any node v gV Predicate SizeC(f) and 
Label(t;) are true and Rule R^ cannot be executed by a node v. So, starting from a legitimate 
configuration for Algorithm NCA-L the system remains in a legitimate configuration. □ 

Definition 3 (Legitimate state of MST) A configuration is legitimate for Algorithm MST iff 
each node v gV satisfies the following conditions: 

1. a tree T spanning the set of nodes in V is constructed; 
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2. T is of minimum weight among all spanning trees. 

Lemma 4 Let Xi = [Vxi^ETj) a tree (or fragment). Eventually for each node v € V^^ the 
variable mwe^ contains a pair of values: the weight of the minimum outgoing edge {u, v) of the 
fragment Ti and 0, if a merging is possible between two fragments Tj and Ti, [j ^ i). 

Proof. We assume that Tj and Tj, (j ^ i) are two distinct coherent trees (i.e., different root 
and correct labels, otherwise Rule Rq and R^ are used to correct the trees) in the network and 
that a merging is possible between Tj and Tj. The computation of the minimum outgoing edge 
of Tj (resp. Tj) is done in a bottom-up fashion. We consider the tree Tj but the computation 
in Tj is done in a same way. A leaf node v can compute and store in its variable mwe^ its 
local adjacent minimum outgoing edge leading to another tree. Macro MinEdge(u) returns the 
local minimum outgoing edge if Macro MergeEdge(i;) ^ 0. To this end, if there is an adjacent 
outgoing edge {u,v) leading to another tree Tj (i.e., MergeAdj(?;) ^ and MergeEdge(f) ^ 0) 
and we have mwe^ ^ MinEdge(f ) then v can execute Rule Rjum to compute its local outgoing 
edge stored in the variable mwcy. A internal node v must use the local outgoing edges computed 
by its children and selects the edge of minimum weight among these edges, then it compares this 
value with the weight of its adjacent local outgoing edge and again it holds the edge of minimum 
weight. The selection of its children minimum outgoing edge is done by Macro MergeChild(w) 
and the computation of its local outgoing edge is done by Macro MergeAdj(i;) as for a leaf 
node. Thus, if there is an outgoing edge which can be used to make a merging with another 
tree (i.e., MergeEdge(f) ^ 0) and we have mwe^ 7^ MinEdge(u) for a internal node v, then 

V can execute Rule RMin to compute in the variable mwe^ its local minimum outgoing edge. 
Using the same argument, one can show by induction that for any internal node v G Vy- we 
have mwcv = MergeEdge. Therefore, the local outgoing edge computed by the root node v is 
the minimum outgoing edge of Tj. □ 

Lemma 5 Let Ti = (Vt-,-©^^) O' ti"^^ (or fragment). Eventually for each node v € Vr^ the 
variable mwe^ contains a pair of values: the weight of an edge {u, v) Et^ and the label of the 
nearest common ancestor of u ^ Vj; and v . Moreover, eventually all local internal edges of v 
are computed. 

Proof. We assume that Tj = (VTi,-E'rJ is a coherent tree, otherwise Rule R0 and R^ are 
used to break the cycles and to correct the labels. Each node v £ Vy. starts to compute local 
internal edges (i.e., edges {x,y) such that x,y £ Vy. and x = -u or x or y is in the subtree of v) 
when it has no local outgoing edge (adjacent outgoing edge or outgoing edge given by a child) 
leading to another tree. In this case, a node v informs its parent of its local internal edges 
using its variable mwe^. Macro RecoverEdge(u) returns the local internal edge of v which has 
the common ancestor nearest from the root among the internal edges that were not taken into 
account by its parent using the node labels. Each node v € Vr^ which is in a recover phase sends 
all its local internal edges. To this end, v compute its next local internal edge when its parent has 
taken into account v's current local internal edge (i.e., mwcp — mwCy) . Thus, the information 
of internal edges are put back up in the tree until reaching the nearest common ancestor and 

V do not wait an acknowledgement from the nearest common ancestor to send its next internal 
edge. Moreover, Macro FarLca(v) compute the next internal edge adjacent to v such that the 
label of the nearest common ancestor associated to (u, v) with u € N{v) is greater (according 
to operator >^) than m?/;e„[l] which is used to define an order on the internal edges. Otherwise, 
if FarLca(i;) = then according to Macro Recover Adj(t') the node v reset the computation of 
its adjacent internal edge to assure that every internal edge is taken into account. The recover 
phase is started at node f if f has no local outgoing edge (i.e., MergeEdge(v) = 0) and v's 
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parent has taken into account the information associated to its current internal edge and stored 
in variable mwey (i.e., uiwcp — TTiU'c^). In this case, the guard of Rule R-A/m is satisfied and 
V can execute Rule RMin to update its variable mwe^ with the information of its next local 
internal edge. The information given by a child are stopped at the nearest common ancestor v 
of the corresponding internal edge since Macro FarLcaChild(?;) selects only mwcu from a child 
u such that m?i;eM[l] <£ iv □ 

Lemma 6 Let T = {Vt,Et) a tree and any edge {x,y) G Ex- Eventually, if {x,y) is not part 
of a minimum spanning tree of the network then (x, y) is removed from T . 

Proof. We assume that T = (Vy, Et) is a coherent tree, otherwise Rule Rq and R^ are used to 
break the cycles and to correct node labels. Let an edge (x, y) € Et (w.l.o.g. Py = x) which is 
not part of a minimum spanning tree. As the network has a finite size then there is a time after 
which there exists no merging between two trees in the network. Thus according to Lemma 5 
each internal edge e of T is put back up in T until reaching the nearest common ancestor 
associated to e. Since (x, y) is not in a minimum spanning tree, there is an edge [u, v) such that 
w{u^ v) < w{x, y) and (x, y) is on the path between u and nca{u, v) or between v and nca{u, v). 
So, there is a time such that mwey = {w{u,v),nca{u,v)) and mwex = {w{u,v),nca{u,v)) 
according to Lemma 5. Then Predicate NewFrag(y) returns true because we have mwey = 
mwex, mwey[l] / \dy and w{x,y) > w{u,v). Therefore, y can execute Rule R^ to create a new 
tree rooted at y and as a consequence the edge (x, y) is removed from T. □ 

Lemma 7 Let two distinct trees Ti = {VTi^ETi) and Tj = (Vt^jEtj) with i ^ j. Let an edge 
(x,y) such that {x,y) is part of a minimum spanning tree and x € Tj and y G T^. Eventually 
(x,y) is used to merge the trees Ti and Tj. 

Proof. We assume that Tj = (Vrij-E/T-J and Tj = (Vr^jETj) are coherent trees, otherwise Rule 
R0 and R^ are used to break the cycles and to correct node labels. According to Lemma 4, 
the merging edge (x, y) is computed by the root and it starts the merging phase since only the 
root can choose the edge of minimum weight leading to another tree to use in order to make a 
merging. In the remainder, we focus on tree Tj but the same arguments are also true for Tj. 

When the root v has finished to compute its minimum outgoing edge from its fragment (i.e., 
we have mwe^ = MergeEdge(t; )) then v can execute Rule R>< because Predicate NeedReorientation(t') 
is satisfied since v has a coherent label. Note that we permit the creation of cycles of length 
two only if at least one node has a label equal to (_L, _L). Indeed, during the merging phase the 
orientation is reversed on the path between the root of Tj and the node adjacent to the edge used 
for the merging, that is why a cycle is detected in Rule Rq if Predicate NeedReorientation(u) is 
not satisfied. Thus, v can change its variables p^ and as following. If there is an edge (x, y) 
adjacent to v such that w{x,y) = mwe^lO] and y = v then v selects x as its new parent (only 
if ld„ > \dx) and v changes its label to (0, 0) to informs its subtree that the merging is done. 
Otherwise, v selects its child u such that mwcu = mwCy as its new parent and v changes its 
label to (_L, _L) to inform u that a merging is started. 

Any other node v on the path between the root and the node adjacent to the merging edge take 
part in the merging phase when its parent has selected v as its new parent (i.e., pp = \dy) and 
u's parent label is equal to (_L, _L). Thus, Predicate NeedReorientation(f ) is satisfied and v can 
execute Rule R><3 since mwCy = MergeEdge(f ) (otherwise Rule RMm is executed to update its 
variable mwCy). So, v changes its variables p^ and iy as described above for the root. Since 
the merging phase is done on a path, using the same argument one can show by induction that 
for any internal node v € Vr^ on the path between the root and the node y adjacent to the 
merging edge (except for y) we have Py = minjldu : u G Child{v) A mwCy = MergeEdge(f )} and 
^„ = (_L, _L) and for the node y we have Py = x and £y = (0, 0). □ 
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Lemma 8 Eventually all the nodes have a correct label in the new fragment resulting from a 
merging phase. 

Proof. According to Lemma 7, a merging phase is done using the minimum outgoing edge 
(x, y) between two distinct trees Tj and Tj if it is possible. Moreover, when the edge (x, y) is 
added by the extremity of minimum identifier, w.l.o.g. let y £, then y's label is equal to (0,0) 
and the end of the merging phase is propagated in the resulting fragment T. In the reminder 
we focus on tree Ti but the same arguments are true for tree Tj. 

Let the node v £ Ti such that = y and = (_L, _L) (i.e., v is the child of y on the 
path between y and the old root of Tj). Predicate NeedReorientation(v) is false because v 
is not a root node and the label of its parent y is not equal to (_L,_L). Moreover, Predicate 
EndReorientation(f ) is true since y's label is equal to (0,0) and v's label to (_L,±). Thus, v 
can execute Rule Rq to modify its label to (0,0). Using the same argument, one can show by 
induction that every node v on the path between y and the old root of Ti can execute Rule Rq, 
thus there is a time such that we have i^, = (0, 0). 

Now we show that the other nodes in Tj can execute Rule Rq- Consider the node r G Vy- such 
that r is the old root of Tj and iz = (0,0). Let a node v € Vr^ such that = \dz. Predicate 
NeedReorientation(v) is false because v is not a root node and the label of its parent is not equal 
to (_L,_L). Moreover, Predicate EndReorientation(u) is true because £z = (0,0) and f's label is 
not equal to (_L, _L) since v is not on the path between y and the old root of Tj, and u's label 
is different from (0,0). Note that since the start of the merging phase. Predicate TreeMerg(t;) 
is true because Predicate NeedReorientation(i)) or EndReorientation(f ) is true. So, Rule R^ 
cannot be executed by v and w's label has not changed. Thus, v can execute Rule Rq to modify 
its label to (0,0). Using the same argument, one can show by induction that every node v on 
the path between z and a leaf node can execute Rule Rq, thus there is a time such that we 
have 4 = (0,0). 

Every node v in the resulting fragment T can execute Rule R^ when the edge {x, y) is added 
in T and y's label has been modified from (0, 0) to its new label based on x's label. Indeed, in 
this case for every node v, with v ^ y and v S Vy. , Predicate TreeMerg(z;) is false and v can 
execute Rule R^. Therefore, there is a time such that every node v m.T has a correct label. □ 

Lemma 9 (Convergence for MST) Starting from an illegitimate configuration for Algorithm 
MST, eventually Algorithm MST reaches in a finite time a legitimate configuration. 

Proof. We assume that there is a forest of trees Tj, 1 < i < n, in the network, otherwise 
according to Lemma 1 Rule Rq is executed to remove the cycle from the network. Moreover, 
we assume also that the node's label are correct in tree Tj, otherwise according to Lemma 2 
and 3 there is a time such that the node's label are corrected. 

According to Lemma 5 and 6, if an edge (u, v) € Et^ and (n, v) is part of no minimum 
spanning tree of the network then [u^v) is removed from tree Tj. Thus, there is a time such 
that the existing fragments in the network are part of a minimum spanning tree. According to 
Lemmas 4 and 7, eventually if there are at least two distinct fragments then a merging phase 
is started. Moreover, node labels are corrected after a merging phase according to Lemma 8. 
Since the size of the network is finite there is a finite number of merging. Therefore, in a finite 
time a spanning tree of minimum weight is computed by Algorithm MST. □ 

Lemma 10 (Closure for MST) The set of legitimate configurations for MST is closed. 

Proof. Let C a legitimate configuration such T = (Vt,T't) is a minimum spanning tree of 
the network and an edge [x^y) € Ex. To be illegitimate, the configuration C must contain an 
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edge {x,y) such that it exists an edge e = {u,v) with w{u,v) < w{x,y) and {x,y) and {u,v) 
are included in the same fundamental cycle Ce- Thus, this imply that the edge e is not used to 
verify if it is possible to replace an edge of Ce with [u, v) which contradicts Lemmas 5 and 6. 
Moreover, since T is a spanning tree then no merging is done in the network. Therefore, starting 
from a legitimate configuration for Algorithm MST a legitimate configuration is preserved. □ 

5 Complexity proofs 

In the following we discuss the complexity issues of our solution. 

Lemma 11 Algorithms NCA-L and MST have a space complexity o/0(log^n) hits. 

Proof. Algorithm NCA-L uses three variables : Py,iv, size^ . The first and the last one are 
respectively a pointer to a neighbor node and a pair of integers, each one needs O(logn) bits. 
However, the variable iy is a list of pairs of integers. A new pair of integers is added to the list 
when a light edge is created in the tree. As noticed in [1], there are at most logn light edges 
on the path from a leaf to the root, i.e., at most logn pairs of integers. Thus, the variable iy 
uses logn x logn bits. 

Algorithm MST uses an additional variable mwCy which is a pair composed of an integer and 
the label of a node. The label of a node is stored in variable iy which uses log^ n bits. Thus, 
the variable mwcy needs log^ n bits. 

Therefore, Algorithms NCA-L and MST use 0(log^ n) bits of memory at each node. □ 

Lemma 12 Starting from any configuration, all cycles are removed from the network in at most 
0{n'^) rounds, with n the number of nodes in the network. 

Proof. As explained in the proof of Lemma 1, to break a cycle a part of the nodes in 
must compute their new labels, that is a label computation must be initiated from one node 
and then this process must cross C^. Thus, the worst case is a configuration in which all the 
nodes in Ck have to compute their new labels using Rule to detect the presence of cycle Ck. 
Therefore, at most 0{n) rounds are needed to compute the new label of the nodes in based 
on the label of one node x in Ck. According to Lemma 1, when this computation is done the 
cycle Ck is detected and removed by the node x. At most 0(n) additional rounds are needed 
to break the cycle Ck- 

Since there is at most n/2 cycles in a network, at most Dip?) rounds are needed to remove 
all the cycles from the network. □ 

Lemma 13 Starting from a configuration which contains a tree T , using Algorithm NCA-L any 
node V &Vt has a correct label in at most 0{n) rounds. 

Proof. As described in proof of Lemma 2, the correction of node labels is done using a 
bottom-up computation followed by a top-down computation in the tree T = {Vr, Et). 

The bottom-up computation is started by the leaves of T, when leaf nodes v Vr have 
corrected their variable sizcy to (1, _L) then internal nodes n € Vr can start to correct their 
variable sizcu ■ An internal node v (zVr computes a correct value in its variable sizCy using Rule 
R^ when all its children u have a correct value in their variable sizCu- Since the computation 
is done in a tree sub-graph then in at most 0(n) rounds each node v & Vr has corrected its 
variable 

The top-down computation is started by the root of the tree T. When the root v has a 
correct value in variable sizCy then the computation of correct labels can start. Thus, if the 
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parent of a node v has a correct value in its variable sizep^ and £p^ then v can compute its 
correct label in using Rule R^. As for the bottom- up computation, the top-down computation 
is done in at most 0(n) rounds since it is performed in a tree sub-graph. 

Therefore, in at most 0(n) rounds each node v in the tree T has a correct label stored in 
variable sizcy. □ 

Lemma 14 Starting from any configuration. Algorithm NCA-L reaches a legitimate configura- 
tion in at most 0{in?) rounds. 

Proof. The initial configuration C could contain one or more cycles, so according to Lemma 12 
in at most O(n^) rounds the system reaches a new configuration C' which contains no cycle. 
Moreover according to Lemma 13, the nodes v in each tree T in the configuration C have a 
correct label in at most 0(n) rounds. Therefore, starting from an arbitrary configuration each 
node V computes its correct label in at most O(n^) rounds. □ 

Lemma 15 Starting from any configuration, Algorithm MST reaches a legitimate configuration 
in at most 0{n'^) rounds. 

Proof. According to Lemma 12, starting from any configuration after at most O(n^) rounds 
all the cycles are removed from the network, i.e., it remains a forest of trees after at most O(n^) 
rounds. Moreover, according to Lemma 13 in at most 0{n) additional rounds each node v £V 
has a correct label since each node belongs to a unique tree. 

According to the description of Algorithm MST, Macro MinEdge(v) and Lemma 5, when it is 
possible to make a merging between two distinct trees in the forest a merging phase is started. 
This merging phase is done in three steps: (1) information corresponding to the minimum 
outgoing edge is propagated in a bottom-up fashion in each tree, (2) the orientation is reversed 
from the root of a tree until reaching the node in the tree adjacent to the minimum outgoing 
edge, and (3) the node labels are changed to inform of the end of the merging phase, followed by 
a propagation of the new correct node labels in the new tree resulting from the merging phase. 

The first step is a propagation of information in a bottom-up fashion in a tree which is done 
in at most 0{n) rounds. The second step reverses and propagates new node labels on a part of 
the tree (between the root and the node adjacent to the minimum outgoing edge) which is done 
in at most 0(n) rounds too. Step 3 modifies the label of the nodes which have changed their 
parent pointer in step 2, so this last step takes also at most 0(n) rounds and the relabeling 
of the nodes in the new tree is done in at most 0{n) rounds according to Lemma 13. Thus, 
a merging phase is accomplished in at most 0{n) rounds and as there are in the worst case n 
trees then in at most O(n^) rounds a spanning tree is constructed. 

When there is no possible merging for a given fragment (or tree) Tj in the forest then the 
correction phase concerning Tj is started. In a tree Tj, the internal edges (i.e., whose two 
endpoints are in Tj) are sent upward in Tj in order to detect incorrect tree edges. The internal 
edges e are sent following an order on the distance between the common ancestor nca(e) and 
the root of Tj, by sending first the edge e with the nearest common ancestor nca(e) from the 
root. Let h{Ti) be the height of tree Tj and d{v) be the distance from v £ Ti to the root of Tj. 
Thus, an internal (resp. leaf) node has at most d{v) — 2 (resp. d{v) — 1) adjacent internal edges. 
Since a leaf node could have a lower priority (compared to its ancestors) to send all its adjacent 
internal edges, then the worst case to correct a tree is the case of a chain. Indeed, if the last 
internal edge of a leaf node x must be used to detect an incorrect tree edge then x may have to 
wait that all its ancestors in the chain have sent their internal edges of higher priority. Thus, 
starting from any configuration after at most 0(/i(Tj)^) rounds Tj contains no incorrect edges. 
Note that this is the worst case time to detect the farthest incorrect tree edge from the root 
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of Tj, otherwise the correction phase is stopped earher for nearest incorrect tree edges because 
the merging phase has a higher priority than the correction phase. Moreover, after 0{h{Tif') 
rounds all the new edges used by Tj for a merging are correct tree edges for Tj. So, Tj does not 
remove another tree edge in a new correction phase. Hence starting from any configuration, 
a correction phase deletes all the incorrect tree edges of a spanning tree after at most O(n^) 
rounds and no new tree edges are removed by a correction phase. 

Therefore, starting from an arbitrary configuration Algorithm MST constructs a minimum 
spanning tree in at most O(n^) rounds. □ 

6 Conclusion 

We extended the Gallager, Humblet and Spira (GHS) algorithm, [9], to self-stabilizing settings 
via a compact informative labeling scheme. Thus, the resulting solution presents several ad- 
vantages appealing for large scale systems: it is compact since it uses only logarithmic memory 
in the size of the network, it scales well since it does not rely on any global parameter of the 
system, it is fast — its time complexity is the better known in self-stabilizing settings. Addi- 
tionally, it self-recovers from any transient fault. The time complexity is O(n^) rounds and the 
space complexity is Oilog^n). 
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